@objectstack/core 17.0.0-rc.6 → 17.1.0

package/dist/index.cjs

@@ -30,11 +30,14 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  ADMIN_STANDING_SURFACE: () => ADMIN_STANDING_SURFACE,
   ANONYMOUS_DENY_BODY: () => ANONYMOUS_DENY_BODY,
   ANONYMOUS_DENY_CODE: () => ANONYMOUS_DENY_CODE,
   ANONYMOUS_DENY_MESSAGE: () => ANONYMOUS_DENY_MESSAGE,
   ANONYMOUS_DENY_STATUS: () => ANONYMOUS_DENY_STATUS,
   API_KEY_PREFIX: () => API_KEY_PREFIX,
+  AUDIENCE_BINDING_SUGGESTION_STATUSES: () => AUDIENCE_BINDING_SUGGESTION_STATUSES,
+  AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES: () => AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES,
   CORE_FALLBACK_FACTORIES: () => CORE_FALLBACK_FACTORIES,
   DependencyResolver: () => DependencyResolver,
   ENTRY_EXECUTION_CONTEXT_FIELDS: () => ENTRY_EXECUTION_CONTEXT_FIELDS,
@@ -63,16 +66,22 @@ __export(index_exports, {
   SecurePluginContext: () => SecurePluginContext,
   SemanticVersionManager: () => SemanticVersionManager,
   ServiceLifecycle: () => ServiceLifecycle,
+  UNMATCHED_ROUTE_PATTERN: () => import_contracts.UNMATCHED_ROUTE_PATTERN,
   UnknownFilterTokenError: () => UnknownFilterTokenError,
   UnresolvedFilterTokenError: () => UnresolvedFilterTokenError,
+  adminStandingColumns: () => adminStandingColumns,
+  adminStandingTables: () => adminStandingTables,
   assembleExecutionContext: () => assembleExecutionContext,
   assembleExecutionContextOrGuest: () => assembleExecutionContextOrGuest,
   assertInitServiceRequirements: () => assertInitServiceRequirements,
+  assertMetadataRegisterContract: () => assertMetadataRegisterContract,
   bucketKeyToCalendarRange: () => bucketKeyToCalendarRange,
   buildPermissionsFromGrants: () => buildPermissionsFromGrants,
   bulkWrite: () => bulkWrite,
   calendarPartsInTz: () => calendarPartsInTz,
   calendarPartsInTzOrUtc: () => calendarPartsInTzOrUtc,
+  canonicalMetadataServiceType: () => canonicalMetadataServiceType,
+  collectInternalWriteResponseFields: () => collectInternalWriteResponseFields,
   counterSignPayload: () => counterSignPayload,
   createLogger: () => createLogger,
   createMemoryCache: () => createMemoryCache,
@@ -86,6 +95,7 @@ __export(index_exports, {
   defaultIsTransientError: () => defaultIsTransientError,
   derivePosture: () => derivePosture,
   describeInitOrderFault: () => describeInitOrderFault,
+  effectiveTenancyPosture: () => effectiveTenancyPosture,
   engineCanRollBack: () => engineCanRollBack,
   evaluateAuthGate: () => evaluateAuthGate,
   extractApiKey: () => extractApiKey,
@@ -97,19 +107,25 @@ __export(index_exports, {
   getMemoryUsage: () => getMemoryUsage,
   hashApiKey: () => hashApiKey,
   hashMigrationPlan: () => hashMigrationPlan,
+  isAudienceBindingSuggestionStatus: () => isAudienceBindingSuggestionStatus,
   isAuthGateAllowlisted: () => isAuthGateAllowlisted,
   isExpired: () => isExpired,
   isGrantActive: () => isGrantActive,
   isGrantExpired: () => isGrantExpired,
   isNode: () => isNode,
+  isRowActive: () => isRowActive,
+  isUninterpretableTemporalComparand: () => isUninterpretableTemporalComparand,
   nextUtcCalendarDay: () => import_data.nextUtcCalendarDay,
   normalizeAuthGate: () => normalizeAuthGate,
+  omitInternalFieldsFromWriteResponse: () => omitInternalFieldsFromWriteResponse,
   parseScopes: () => parseScopes,
   parseSignature: () => parseSignature,
   planChunks: () => planChunks,
   postureVisibleRows: () => postureVisibleRows,
   readAuthoredTranslationLayer: () => readAuthoredTranslationLayer,
   readRunJournal: () => readRunJournal,
+  recordNotFoundError: () => recordNotFoundError,
+  resolveApiKeyAdmission: () => resolveApiKeyAdmission,
   resolveApiKeyPrincipal: () => resolveApiKeyPrincipal,
   resolveAuthzContext: () => resolveAuthzContext,
   resolveFilterToken: () => resolveFilterToken,
@@ -123,6 +139,8 @@ __export(index_exports, {
   safeExit: () => safeExit,
   shouldDenyAnonymous: () => shouldDenyAnonymous,
   signPayload: () => signPayload,
+  temporalComparandKind: () => temporalComparandKind,
+  unknownAudienceBindingSuggestionStatusMessage: () => unknownAudienceBindingSuggestionStatusMessage,
   utcInstantMs: () => import_data.utcInstantMs,
   validateInitServiceContract: () => validateInitServiceContract,
   verifyPayload: () => verifyPayload,
@@ -132,7 +150,8 @@ __export(index_exports, {
   wireAuthoredTranslationSync: () => wireAuthoredTranslationSync,
   withTransientRetry: () => withTransientRetry,
   withoutOperationPrivateKeys: () => withoutOperationPrivateKeys,
-  zonedDateStartToUtcMs: () => zonedDateStartToUtcMs
+  zonedDateStartToUtcMs: () => zonedDateStartToUtcMs,
+  zonedWallClockToUtcMs: () => zonedWallClockToUtcMs
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -837,7 +856,7 @@ function createLogger(config) {
 }
 
 // src/kernel.ts
-var import_system2 = require("@objectstack/spec/system");
+var import_system3 = require("@objectstack/spec/system");
 
 // src/security/plugin-config-validator.ts
 var import_zod = require("zod");
@@ -1505,6 +1524,7 @@ function createMemoryJob() {
 }
 
 // src/fallbacks/memory-i18n.ts
+var import_system = require("@objectstack/spec/system");
 function deepMerge(target, source) {
   const result = { ...target };
   for (const key of Object.keys(source)) {
@@ -1538,6 +1558,7 @@ function createMemoryI18n() {
   const translations = /* @__PURE__ */ new Map();
   const authored = /* @__PURE__ */ new Map();
   let defaultLocale = "en";
+  let supportedLocales;
   function resolveKey(data, key) {
     const parts = key.split(".");
     let current = data;
@@ -1603,9 +1624,29 @@ function createMemoryI18n() {
         authored.set(locale, { ...data });
       }
     },
+    /**
+     * Report the locales this stack offers.
+     *
+     * [#7679] When the app declared `i18n.supportedLocales`, that declaration
+     * IS the answer — in declared order, and including a declared locale no
+     * bundle was ever loaded for (declared-but-unserved). Reporting the
+     * declaration rather than an intersection is what gives a client the
+     * signal that the locale it is being offered has nothing behind it yet;
+     * quietly dropping it would leave the gap invisible on both sides. It is
+     * also the only answer that does not depend on how much had loaded by the
+     * time this was called.
+     *
+     * With nothing declared, the loaded set — the behaviour every app that
+     * never opted in already has.
+     */
     getLocales() {
+      if (supportedLocales) return [...supportedLocales];
       return [.../* @__PURE__ */ new Set([...translations.keys(), ...authored.keys()])];
     },
+    /** @see II18nService.setSupportedLocales — [#7679] */
+    setSupportedLocales(locales) {
+      supportedLocales = (0, import_system.normalizeSupportedLocales)(locales);
+    },
     getDefaultLocale() {
       return defaultLocale;
     },
@@ -1615,14 +1656,42 @@ function createMemoryI18n() {
   };
 }
 
+// src/metadata-service-contract.ts
+var import_shared = require("@objectstack/spec/shared");
+var REGISTER_REFUSAL_CODE = "VALIDATION_ERROR";
+function canonicalMetadataServiceType(type) {
+  return (0, import_shared.pluralToSingular)(type);
+}
+function registerRefusal(message) {
+  const err = new Error(message);
+  err.code = REGISTER_REFUSAL_CODE;
+  err.status = 400;
+  return err;
+}
+function assertMetadataRegisterContract(type, name, data) {
+  if (typeof data !== "object" || data === null || Array.isArray(data)) {
+    const shape = data === null ? "null" : Array.isArray(data) ? "an array" : `a ${typeof data}`;
+    throw registerRefusal(
+      `IMetadataService.register('${type}', '${name}'): data is ${shape}, not a metadata document. register() stores plain-object documents only \u2014 accepting a value the service cannot key was measured as accept-then-drop on document-keyed stores (#7378 row 3: refuse loudly, never coerce into storability). Wrap the value in a document object whose shape the '${type}' type's schema accepts, or store it under a type that declares one.`
+    );
+  }
+  const documentName = data.name;
+  if (documentName !== void 0 && documentName !== name) {
+    throw registerRefusal(
+      `IMetadataService.register('${type}', '${name}'): data.name is '${String(documentName)}', which disagrees with the name argument '${name}'. A disagreement is almost always an authoring bug, and resolving it silently in either direction can file the item under a key the caller never wrote (#7378 row 1: refuse loudly, locate the mismatch). Register under one name: pass the intended key as the argument and make data.name match it, or omit data.name.`
+    );
+  }
+}
+
 // src/fallbacks/memory-metadata.ts
 function createMemoryMetadata() {
   const store = /* @__PURE__ */ new Map();
   function getTypeMap(type) {
-    let map = store.get(type);
+    const canonical = canonicalMetadataServiceType(type);
+    let map = store.get(canonical);
     if (!map) {
       map = /* @__PURE__ */ new Map();
-      store.set(type, map);
+      store.set(canonical, map);
     }
     return map;
   }
@@ -1637,6 +1706,7 @@ function createMemoryMetadata() {
     },
     _serviceName: "metadata",
     async register(type, name, data) {
+      assertMetadataRegisterContract(type, name, data);
       getTypeMap(type).set(name, data);
     },
     // Mirror MetadataManager.registerInMemory (synchronous, no persistence).
@@ -1648,7 +1718,11 @@ function createMemoryMetadata() {
     // so `defineStack({ datasources })` entries silently never reached the
     // registry and were absent from GET /api/v1/datasources and
     // GET /api/v1/meta/datasource (ADR-0015 §18). This store is already
-    // in-memory only, so registerInMemory and register share an implementation.
+    // in-memory only, so registerInMemory and register share a store — but
+    // NOT the [#7378] refusals: the ruling names `register`, and this member
+    // is a boot-time seeding primitive for source-control-owned artefacts
+    // (see assertMetadataRegisterContract's header for the boundary). It does
+    // share the row-2 canonical type fold, via getTypeMap.
     registerInMemory(type, name, data) {
       getTypeMap(type).set(name, data);
     },
@@ -1677,7 +1751,7 @@ function createMemoryMetadata() {
 }
 
 // src/fallbacks/authored-translation-sync.ts
-var import_system = require("@objectstack/spec/system");
+var import_system2 = require("@objectstack/spec/system");
 var OWNER_PROP = "__authoredTranslationSyncOwner";
 var LOCALE_LIKE = /^[a-z]{2,3}([_-]([A-Za-z]{4}|[A-Za-z]{2}|[0-9]{3}))?$/;
 async function readAuthoredTranslationLayer(engine, logger) {
@@ -1707,7 +1781,7 @@ async function readAuthoredTranslationLayer(engine, logger) {
       continue;
     }
     if (!data || typeof data !== "object") continue;
-    const legacyKeys = import_system.LEGACY_OBJECT_FIRST_KEYS.filter((key) => data[key] !== void 0);
+    const legacyKeys = import_system2.LEGACY_OBJECT_FIRST_KEYS.filter((key) => data[key] !== void 0);
     if (legacyKeys.length > 0) {
       logger?.warn?.(
         `[i18n] authored translation '${row?.name}' uses the retired object-first shape (${legacyKeys.join(", ")}) \u2014 nothing resolves from it; re-author it under 'objects.<object_name>' with a top-level 'locale' \u2014 skipped`
@@ -1812,6 +1886,26 @@ var CORE_FALLBACK_FACTORIES = {
   i18n: createMemoryI18n
 };
 
+// src/plugin-registration.ts
+function versionLabel(plugin) {
+  return plugin.version ? `v${plugin.version}` : "unversioned";
+}
+function describeSupersededRegistration(previous, next) {
+  return `Plugin superseded: '${next.name}' \u2014 the later registration (${versionLabel(next)}) REPLACED the earlier one (${versionLabel(previous)}). Only the later instance is initialized and started; the earlier one is discarded without ever running init(). Duplicate registration by name is last-one-wins on both kernels by declared contract (#9864) \u2014 register the plugin once if that is not what you meant.`;
+}
+function registerPluginByName(registry, plugin, logger) {
+  const previous = registry.get(plugin.name);
+  if (previous !== void 0) {
+    logger.warn(describeSupersededRegistration(previous, plugin), {
+      plugin: plugin.name,
+      supersededVersion: previous.version,
+      supersedingVersion: plugin.version
+    });
+  }
+  registry.set(plugin.name, plugin);
+  return previous;
+}
+
 // src/kernel.ts
 var ObjectKernel = class {
   constructor(config = {}) {
@@ -1896,6 +1990,14 @@ var ObjectKernel = class {
   }
   /**
    * Register a plugin with enhanced validation
+   *
+   * Duplicate names OVERWRITE, with one `warn` naming both versions — the
+   * declared contract in `plugin-registration.ts`, applied identically by
+   * `LiteKernel.use()` (#9864, maintainer ruling 2026-08-19). The overwrite
+   * itself is unchanged: it is what lets an app config's `plugins` entry
+   * supersede a plugin the CLI auto-registered earlier in the same boot
+   * (#9863). What changes is that it is no longer silent, and no longer
+   * disagrees with the other kernel.
    */
   async use(plugin) {
     if (this.state !== "idle") {
@@ -1906,11 +2008,13 @@ var ObjectKernel = class {
       throw new Error(`Failed to load plugin: ${plugin.name} - ${result.error?.message}`);
     }
     const pluginMeta = result.plugin;
-    this.plugins.set(pluginMeta.name, pluginMeta);
-    this.logger.info(`Plugin registered: ${pluginMeta.name}@${pluginMeta.version}`, {
-      plugin: pluginMeta.name,
-      version: pluginMeta.version
-    });
+    const superseded = registerPluginByName(this.plugins, pluginMeta, this.logger);
+    if (superseded === void 0) {
+      this.logger.info(`Plugin registered: ${pluginMeta.name}@${pluginMeta.version}`, {
+        plugin: pluginMeta.name,
+        version: pluginMeta.version
+      });
+    }
     return this;
   }
   /**
@@ -1945,7 +2049,7 @@ var ObjectKernel = class {
    */
   preInjectCoreFallbacks() {
     if (this.config.skipSystemValidation) return;
-    for (const [serviceName, criticality] of Object.entries(import_system2.ServiceRequirementDef)) {
+    for (const [serviceName, criticality] of Object.entries(import_system3.ServiceRequirementDef)) {
       if (criticality !== "core") continue;
       const hasService = this.services.has(serviceName) || this.pluginLoader.hasService(serviceName);
       if (!hasService) {
@@ -1969,7 +2073,7 @@ var ObjectKernel = class {
     this.logger.debug("Validating system service requirements...");
     const missingServices = [];
     const missingCoreServices = [];
-    for (const [serviceName, criticality] of Object.entries(import_system2.ServiceRequirementDef)) {
+    for (const [serviceName, criticality] of Object.entries(import_system3.ServiceRequirementDef)) {
       const hasService = this.services.has(serviceName) || this.pluginLoader.hasService(serviceName);
       if (!hasService) {
         if (criticality === "required") {
@@ -2388,14 +2492,21 @@ var LiteKernel = class extends ObjectKernelBase {
   /**
    * Register a plugin
    * @param plugin - Plugin instance
+   *
+   * Duplicate names OVERWRITE, with one `warn` naming both versions — the
+   * declared contract in `plugin-registration.ts`, applied identically by
+   * `ObjectKernel.use()` (#9864, maintainer ruling 2026-08-19).
+   *
+   * This method used to `throw` `[Kernel] Plugin '<name>' already
+   * registered` here while `ObjectKernel` overwrote silently, so one input
+   * had two meanings depending on which kernel was running — and the kernel
+   * that runs in production was the silent one. The ruling converged them on
+   * the behaviour that already works (an app config superseding a plugin the
+   * CLI auto-registered, #9863) and made it audible rather than removing it.
    */
   use(plugin) {
     this.validateIdle();
-    const pluginName = plugin.name;
-    if (this.plugins.has(pluginName)) {
-      throw new Error(`[Kernel] Plugin '${pluginName}' already registered`);
-    }
-    this.plugins.set(pluginName, plugin);
+    registerPluginByName(this.plugins, plugin, this.logger);
     return this;
   }
   /**
@@ -2644,11 +2755,119 @@ var TestRunner = class {
 };
 
 // src/qa/http-adapter.ts
+var import_api = require("@objectstack/spec/api");
+var conventionCache;
+function conventionMounts() {
+  if (conventionCache === void 0) {
+    const api = import_api.RestApiConfigSchema.parse({});
+    const crud = import_api.CrudEndpointsConfigSchema.parse({});
+    const apiBase = api.apiPath ?? `${api.basePath}/${api.version}`;
+    conventionCache = { apiBase, dataPath: `${apiBase}${crud.dataPrefix}` };
+  }
+  return conventionCache;
+}
 var HttpTestAdapter = class {
   constructor(baseUrl, authToken) {
     this.baseUrl = baseUrl;
     this.authToken = authToken;
   }
+  /** The resolved data mount; probes at most once per adapter. */
+  dataMount() {
+    if (this.mountPromise === void 0) {
+      this.mountPromise = this.resolveDataMount();
+    }
+    return this.mountPromise;
+  }
+  /**
+   * Ask the server where it serves the Data Protocol, and fall back to the
+   * convention — loudly — when it cannot say.
+   *
+   * ## [#7983] What the probe recovers, measured rather than assumed
+   *
+   * `@objectstack/client` answers the same question through discovery
+   * (`getRoute`, `packages/client/src/index.ts`), and this follows it: prefer
+   * the server's own `routes.data`, fall back to the convention. Measured on a
+   * booted stack (REST generator + dispatcher bridge, three configs):
+   *
+   *   | deployment                     | `{apiBase}/discovery` | serves        |
+   *   |--------------------------------|-----------------------|---------------|
+   *   | stock                          | 200 `/api/v1/data`    | `/api/v1/data`|
+   *   | `crud.dataPrefix: '/objects'`  | 200 `/api/v1/objects` | `/api/v1/objects` |
+   *   | `api.apiPath: '/api/2026-01'`  | **404**               | `/api/2026-01/data` |
+   *
+   * So the probe closes the `dataPrefix` row exactly: `RestServer`'s discovery
+   * handler substitutes the configured prefix into `routes.data`, and reading
+   * it is strictly better than recomputing it here. The `apiPath` row it cannot
+   * close, and the reason is structural rather than an oversight — `apiPath`
+   * moves the base that discovery itself is mounted under, so the document that
+   * would name the new mount is behind the very prefix we are missing.
+   *
+   * ⛔ And the one discovery document at a FIXED path does not rescue it:
+   * `/.well-known/objectstack` is mounted at the site root by the dispatcher
+   * bridge, but its `routes.data` is the DISPATCHER's own `${prefix}/data` —
+   * measured as `/api/v1/data` under all three configs above, including the two
+   * where the server serves elsewhere. Falling back to it would turn "we could
+   * not resolve the mount" into "discovery told us `/api/v1/data`": the same
+   * 404, now with a false provenance attached. Not probed, deliberately.
+   *
+   * Hence: one probe, then a diagnostic that NAMES the mount, the evidence and
+   * the remedy. `api_call` takes the path it is given and is unaffected either
+   * way — it stays the escape hatch for a host this cannot reach.
+   */
+  async resolveDataMount() {
+    const { apiBase, dataPath } = conventionMounts();
+    const probeUrl = `${this.baseUrl}${apiBase}/discovery`;
+    let why;
+    try {
+      const headers = {};
+      if (this.authToken) {
+        headers["Authorization"] = `Bearer ${this.authToken}`;
+      }
+      const response = await fetch(probeUrl, { method: "GET", headers });
+      if (response.ok) {
+        const body = await response.json();
+        const doc = body && typeof body === "object" && "routes" in body ? body : body?.data;
+        const advertised = doc?.routes?.data;
+        if (typeof advertised === "string" && advertised.length > 0) {
+          return {
+            path: advertised,
+            source: "discovery",
+            why: `GET ${probeUrl} advertised routes.data`
+          };
+        }
+        why = `GET ${probeUrl} answered ${response.status} but carried no routes.data`;
+      } else {
+        why = `GET ${probeUrl} answered ${response.status}`;
+      }
+    } catch (error) {
+      why = `GET ${probeUrl} could not be reached (${error.message})`;
+    }
+    const mount = { path: dataPath, source: "convention", why };
+    console.warn(
+      `[HttpTestAdapter] Data Protocol mount NOT resolved from discovery. Record actions (create_record, read_record, update_record, delete_record, query_records) will address ${this.baseUrl}${dataPath}, the convention declared by RestApiConfigSchema (apiPath ?? basePath/version) + CrudEndpointsConfigSchema.dataPrefix. Evidence: ${why}. A deployment that sets crud.dataPrefix is normally recovered by this probe; one that sets api.apiPath moves discovery itself out from under it, and no fixed-path document reports the REST mount \u2014 write those steps as api_call, which takes the path you give it.`
+    );
+    return mount;
+  }
+  /** `{baseUrl}{dataMount}/{object}` — the collection URL. */
+  collectionUrl(mount, objectName) {
+    return `${this.baseUrl}${mount.path}/${encodeURIComponent(objectName)}`;
+  }
+  /** `{collection}/{id}` — the single-record URL. */
+  recordUrl(mount, objectName, id) {
+    return `${this.collectionUrl(mount, objectName)}/${encodeURIComponent(String(id))}`;
+  }
+  /**
+   * The provenance clause appended to a failed record action's error.
+   *
+   * The card this closes is about a 404 that reads like the author's own URL
+   * mistake; the mount is the one fact that distinguishes the two, so it rides
+   * on the failure itself rather than only on a warning printed earlier in the
+   * transcript.
+   */
+  mountNote(mount) {
+    const how = mount.source === "discovery" ? "resolved from discovery" : "assumed by convention \u2014 the server was not able to state it";
+    return `record actions addressed ${this.baseUrl}${mount.path} (data mount ${how}: ${mount.why})`;
+  }
   async execute(action, _context) {
     const headers = {
       "Content-Type": "application/json"
@@ -2680,48 +2899,53 @@ var HttpTestAdapter = class {
     }
   }
   async createRecord(objectName, data, headers) {
-    const response = await fetch(`${this.baseUrl}/api/data/${objectName}`, {
+    const mount = await this.dataMount();
+    const response = await fetch(this.collectionUrl(mount, objectName), {
       method: "POST",
       headers,
       body: JSON.stringify(data)
     });
-    return this.handleResponse(response);
+    return this.handleResponse(response, this.mountNote(mount));
   }
   async updateRecord(objectName, data, headers) {
-    const id = data.id;
+    const { id, ...fields } = data;
     if (!id) throw new Error("Update record requires id in payload");
-    const response = await fetch(`${this.baseUrl}/api/data/${objectName}/${id}`, {
-      method: "PUT",
+    const mount = await this.dataMount();
+    const response = await fetch(this.recordUrl(mount, objectName, id), {
+      method: "PATCH",
       headers,
-      body: JSON.stringify(data)
+      body: JSON.stringify(fields)
     });
-    return this.handleResponse(response);
+    return this.handleResponse(response, this.mountNote(mount));
   }
   async deleteRecord(objectName, data, headers) {
     const id = data.id;
     if (!id) throw new Error("Delete record requires id in payload");
-    const response = await fetch(`${this.baseUrl}/api/data/${objectName}/${id}`, {
+    const mount = await this.dataMount();
+    const response = await fetch(this.recordUrl(mount, objectName, id), {
       method: "DELETE",
       headers
     });
-    return this.handleResponse(response);
+    return this.handleResponse(response, this.mountNote(mount));
   }
   async readRecord(objectName, data, headers) {
     const id = data.id;
     if (!id) throw new Error("Read record requires id in payload");
-    const response = await fetch(`${this.baseUrl}/api/data/${objectName}/${id}`, {
+    const mount = await this.dataMount();
+    const response = await fetch(this.recordUrl(mount, objectName, id), {
       method: "GET",
       headers
     });
-    return this.handleResponse(response);
+    return this.handleResponse(response, this.mountNote(mount));
   }
   async queryRecords(objectName, data, headers) {
-    const response = await fetch(`${this.baseUrl}/api/data/${objectName}/query`, {
+    const mount = await this.dataMount();
+    const response = await fetch(`${this.collectionUrl(mount, objectName)}/query`, {
       method: "POST",
       headers,
       body: JSON.stringify(data)
     });
-    return this.handleResponse(response);
+    return this.handleResponse(response, this.mountNote(mount));
   }
   async rawApiCall(endpoint, data, headers) {
     const method = data.method || "GET";
@@ -2734,10 +2958,13 @@ var HttpTestAdapter = class {
     });
     return this.handleResponse(response);
   }
-  async handleResponse(response) {
+  async handleResponse(response, mountNote) {
     if (!response.ok) {
       const text = await response.text();
-      throw new Error(`HTTP Error ${response.status}: ${text}`);
+      const wrongUrlShaped = response.status === 404 || response.status === 405;
+      throw new Error(
+        `HTTP Error ${response.status}: ${text}${wrongUrlShaped && mountNote ? ` \u2014 ${mountNote}` : ""}`
+      );
     }
     const contentType = response.headers.get("content-type");
     if (contentType && contentType.includes("application/json")) {
@@ -4079,6 +4306,7 @@ var PluginSecurityScanner = class {
 
 // src/security/api-key.ts
 var import_node_crypto2 = require("crypto");
+var import_security = require("@objectstack/spec/security");
 var API_KEY_PREFIX = "osk_";
 var API_KEY_ENTROPY_BYTES = 32;
 var VISIBLE_PREFIX_LEN = 12;
@@ -4132,10 +4360,18 @@ function isExpired(value, nowMs) {
   if (Number.isNaN(ms)) return false;
   return ms <= nowMs;
 }
-async function resolveApiKeyPrincipal(ql, headers, nowMs = Date.now()) {
+function effectiveTenancyPosture(tenancy) {
+  if (!tenancy) return void 0;
+  return (0, import_security.normalizeTenancyPosture)(tenancy.posture) ?? (tenancy.isolationActive ? "isolated" : "single");
+}
+async function resolveApiKeyPrincipal(ql, headers, nowMs = Date.now(), tenancyPosture) {
+  const admission = await resolveApiKeyAdmission(ql, headers, nowMs, tenancyPosture);
+  return admission.outcome === "admitted" ? admission.principal : void 0;
+}
+async function resolveApiKeyAdmission(ql, headers, nowMs = Date.now(), tenancyPosture) {
   const apiKey = extractApiKey(headers);
-  if (!apiKey) return void 0;
-  if (!ql || typeof ql.find !== "function") return void 0;
+  if (!apiKey) return { outcome: "none" };
+  if (!ql || typeof ql.find !== "function") return { outcome: "none" };
   let rows;
   try {
     rows = await ql.find("sys_api_key", {
@@ -4144,19 +4380,29 @@ async function resolveApiKeyPrincipal(ql, headers, nowMs = Date.now()) {
       context: { isSystem: true }
     });
   } catch {
-    return void 0;
+    return { outcome: "none" };
   }
   if (rows && rows.value) rows = rows.value;
   const row = Array.isArray(rows) ? rows[0] : void 0;
-  if (!row || row.revoked === true) return void 0;
+  if (!row || row.revoked === true) return { outcome: "none" };
   const expiresAt = row.expires_at ?? row.expiresAt;
-  if (isExpired(expiresAt, nowMs)) return void 0;
+  if (isExpired(expiresAt, nowMs)) return { outcome: "none" };
   const userId = row.user_id ?? row.userId;
-  if (!userId || typeof userId !== "string") return void 0;
+  if (!userId || typeof userId !== "string") return { outcome: "none" };
+  const tenantId = typeof row.active_organization_id === "string" && row.active_organization_id ? row.active_organization_id : void 0;
+  if (!tenantId && tenancyPosture) {
+    const posture = tenancyPosture;
+    if ((0, import_security.postureEnforcesWall)(posture) && !(0, import_security.postureUsesUnionScope)(posture)) {
+      return {
+        outcome: "refused",
+        reason: "organization_required",
+        message: "This API key carries no organization and cannot be used under the `isolated` tenancy posture, where every organization-scoped read is walled to an active organization. Mint a replacement key \u2014 new keys inherit the minter\u2019s active organization."
+      };
+    }
+  }
   return {
-    userId,
-    tenantId: row.organization_id ?? row.organizationId ?? void 0,
-    scopes: parseScopes(row.scopes)
+    outcome: "admitted",
+    principal: { userId, tenantId, scopes: parseScopes(row.scopes) }
   };
 }
 function readHeader(headers, name) {
@@ -4184,6 +4430,7 @@ function safeJsonParse(s, fallback) {
 
 // src/security/resolve-authz-context.ts
 var import_spec = require("@objectstack/spec");
+var import_security2 = require("@objectstack/spec/security");
 
 // src/security/grant-validity.ts
 function toEpochMs(value) {
@@ -4266,6 +4513,15 @@ function postureVisibleRows(posture, rows, principal) {
   }
 }
 
+// src/security/row-active.ts
+var DEACTIVATED_VALUES = [false, 0, "0", "false"];
+function isRowActive(row) {
+  if (!row) return false;
+  const value = row.active;
+  if (value === void 0 || value === null) return true;
+  return !DEACTIVATED_VALUES.includes(value);
+}
+
 // src/security/resolve-authz-context.ts
 function safeJsonParse2(s, fallback) {
   try {
@@ -4295,7 +4551,12 @@ async function resolveAuthzContext(input) {
   };
   let userId;
   let tenantId;
-  const keyPrincipal = await resolveApiKeyPrincipal(ql, headers, input.nowMs);
+  const admission = await resolveApiKeyAdmission(ql, headers, input.nowMs, input.tenancyPosture);
+  if (admission.outcome === "refused") {
+    ctx.authRefusal = { reason: admission.reason, message: admission.message };
+    return ctx;
+  }
+  const keyPrincipal = admission.outcome === "admitted" ? admission.principal : void 0;
   if (keyPrincipal) {
     userId = keyPrincipal.userId;
     tenantId = keyPrincipal.tenantId;
@@ -4323,6 +4584,22 @@ async function resolveAuthzContext(input) {
     seedPermissions: ctx.permissions,
     seedEmail: ctx.email
   });
+  if (keyPrincipal?.tenantId && input.tenancyPosture) {
+    const posture = input.tenancyPosture;
+    if ((0, import_security2.postureEnforcesWall)(posture) && !grants.accessible_org_ids.includes(keyPrincipal.tenantId)) {
+      return {
+        positions: [],
+        permissions: [],
+        systemPermissions: [],
+        org_user_ids: [],
+        accessible_org_ids: [],
+        authRefusal: {
+          reason: "organization_membership_ended",
+          message: "This API key authenticates into an organization its owner is no longer a member of. The key was not revoked \u2014 the membership that backed it ended."
+        }
+      };
+    }
+  }
   ctx.positions = grants.positions;
   ctx.permissions = grants.permissions;
   ctx.systemPermissions = grants.systemPermissions;
@@ -4407,7 +4684,13 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
   if (!grants.positions.includes("everyone")) grants.positions.push("everyone");
   if (grants.positions.length > 0) {
     const positionRows = await tryFind(ql, "sys_position", { name: { $in: grants.positions } }, 100);
-    const positionIds = positionRows.map((r) => r.id).filter(Boolean);
+    const deactivatedNames = new Set(
+      positionRows.filter((r) => !isRowActive(r)).map((r) => r.name).filter(Boolean)
+    );
+    if (deactivatedNames.size > 0) {
+      grants.positions = grants.positions.filter((n) => !deactivatedNames.has(n));
+    }
+    const positionIds = positionRows.filter((r) => isRowActive(r)).map((r) => r.id).filter(Boolean);
     if (positionIds.length > 0) {
       const rpsRows = await tryFind(ql, "sys_position_permission_set", { position_id: { $in: positionIds } }, 500);
       for (const r of rpsRows) {
@@ -4417,7 +4700,8 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
     }
   }
   if (psIds.size > 0) {
-    const psRows = await tryFind(ql, "sys_permission_set", { id: { $in: Array.from(psIds) } }, 500);
+    const psRowsAll = await tryFind(ql, "sys_permission_set", { id: { $in: Array.from(psIds) } }, 500);
+    const psRows = psRowsAll.filter((r) => isRowActive(r));
     const tabRank = { hidden: 0, default_off: 1, default_on: 2, visible: 3 };
     const mergedTabs = {};
     for (const ps of psRows) {
@@ -4648,6 +4932,7 @@ var ANONYMOUS_DENY_CODE = "UNAUTHENTICATED";
 var ANONYMOUS_DENY_MESSAGE = "Authentication is required to access this endpoint.";
 var ANONYMOUS_DENY_BODY = {
   error: ANONYMOUS_DENY_CODE,
+  code: ANONYMOUS_DENY_CODE,
   message: ANONYMOUS_DENY_MESSAGE
 };
 function shouldDenyAnonymous(input) {
@@ -4661,6 +4946,88 @@ function shouldDenyAnonymous(input) {
   return true;
 }
 
+// src/security/admin-standing-surface.ts
+var ADMIN_STANDING_SURFACE = {
+  sys_permission_set: {
+    role: "derives",
+    reason: "The row `platform_admin` is resolved BY NAME from (\xA76b). Renaming it, deleting it or switching it off (ADR-0049 `active`, read here since #8613) un-makes every platform admin at once, with no identity table touched.",
+    columns: [
+      "id",
+      "name",
+      "active",
+      "system_permissions",
+      "systemPermissions",
+      "tab_permissions",
+      "tabPermissions"
+    ]
+  },
+  sys_user_permission_set: {
+    role: "derives",
+    reason: "The grant that makes a user a platform admin: an UNSCOPED, in-window (ADR-0091) grant of `admin_full_access` (\xA76). Re-pointing it, scoping it to an organization or moving it out of its window revokes the standing while leaving the row in place.",
+    columns: [
+      "user_id",
+      "permission_set_id",
+      "permissionSetId",
+      "organization_id",
+      "organizationId",
+      "valid_from",
+      "validFrom",
+      "valid_until",
+      "validUntil"
+    ]
+  },
+  sys_member: {
+    role: "derives",
+    reason: "Organization owner/admin standing (\xA73). The graded `role` is projected into `positions` here and separately drives the `organization_admin` capability grant, which is what the posture ladder reads; the break-glass guard counts the same rows one step earlier, by grade (ADR-0108). Either way a downgrade of the last graded membership is a write that can empty the administrator population.",
+    columns: [
+      "user_id",
+      "userId",
+      "organization_id",
+      "organizationId",
+      "role",
+      "valid_from",
+      "validFrom",
+      "valid_until",
+      "validUntil"
+    ]
+  },
+  sys_user: {
+    role: "reads-only",
+    reason: "Read for the `current_user.email` RLS fallback and the ADR-0024 `ai_seat` synthesis (\xA77). Neither confers administrator standing. The guard does watch this table, but for the ban/delete WRITE SHAPES \u2014 `banned` is never read here, so it is not a derivation column and carries no standing-key list."
+  },
+  sys_user_position: {
+    role: "reads-only",
+    reason: "ADR-0057 D4 platform-RBAC position assignments (\xA74). A position can carry permission sets (see `sys_position_permission_set`) but never platform-admin standing \u2014 \xA76b requires the set to be reached through an unscoped USER grant (`unscopedUserPsIds`), so a position-bound `admin_full_access` resolves the set name into `permissions` and leaves `hasPlatformAdminGrant` false."
+  },
+  sys_position: {
+    role: "reads-only",
+    reason: "Read to drop DEACTIVATED positions (ADR-0049, \xA76a). Same reason as `sys_user_position`: the position path cannot reach `hasPlatformAdminGrant`."
+  },
+  sys_position_permission_set: {
+    role: "reads-only",
+    reason: "Position-bound permission sets (\xA76a). Contributes ids to `psIds` \u2014 and therefore names to `permissions` \u2014 but not to `unscopedUserPsIds`, which is the set \xA76b tests for platform-admin standing."
+  }
+};
+function adminStandingTables() {
+  return Object.entries(ADMIN_STANDING_SURFACE).filter(([, t]) => t.role === "derives").map(([name]) => name).sort();
+}
+function adminStandingColumns(table) {
+  const entry = ADMIN_STANDING_SURFACE[table];
+  return entry?.role === "derives" ? entry.columns : void 0;
+}
+
+// src/security/audience-binding-suggestion-status.ts
+var AUDIENCE_BINDING_SUGGESTION_STATUSES = {
+  pending: true,
+  confirmed: true,
+  dismissed: true
+};
+var AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES = Object.keys(
+  AUDIENCE_BINDING_SUGGESTION_STATUSES
+);
+var isAudienceBindingSuggestionStatus = (value) => Object.prototype.hasOwnProperty.call(AUDIENCE_BINDING_SUGGESTION_STATUSES, value);
+var unknownAudienceBindingSuggestionStatusMessage = (value) => `Unknown status filter '${value}' \u2014 expected one of: ${AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES.join(", ")}`;
+
 // src/security/operation-private-keys.ts
 var OPERATION_PRIVATE_KEY_PREFIX = "__";
 function withoutOperationPrivateKeys(exec) {
@@ -4699,10 +5066,26 @@ function calendarPartsInTzOrUtc(d, tz) {
 }
 function zonedDateStartToUtcMs(ymd2, tz) {
   const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(ymd2);
-  const wallAsUtc = m ? Date.UTC(Number(m[1]), Number(m[2]) - 1, Number(m[3])) : NaN;
+  if (!m) return NaN;
+  return zonedWallClockToUtcMs(
+    { year: Number(m[1]), month: Number(m[2]), day: Number(m[3]) },
+    tz
+  );
+}
+function zonedWallClockToUtcMs(parts, tz) {
+  const wallAsUtc = Date.UTC(
+    parts.year,
+    parts.month - 1,
+    parts.day,
+    parts.hour ?? 0,
+    parts.minute ?? 0,
+    parts.second ?? 0,
+    parts.millisecond ?? 0
+  );
   if (!tz || tz === "UTC" || Number.isNaN(wallAsUtc)) return wallAsUtc;
   try {
     const offsetAt = (t) => {
+      const whole = Math.floor(t / 1e3) * 1e3;
       const p = new Intl.DateTimeFormat("en-US", {
         timeZone: tz,
         hourCycle: "h23",
@@ -4712,9 +5095,9 @@ function zonedDateStartToUtcMs(ymd2, tz) {
         hour: "2-digit",
         minute: "2-digit",
         second: "2-digit"
-      }).formatToParts(new Date(t));
+      }).formatToParts(new Date(whole));
       const g = (k) => Number(p.find((x) => x.type === k)?.value);
-      return Date.UTC(g("year"), g("month") - 1, g("day"), g("hour"), g("minute"), g("second")) - t;
+      return Date.UTC(g("year"), g("month") - 1, g("day"), g("hour"), g("minute"), g("second")) - whole;
     };
     const off1 = offsetAt(wallAsUtc - offsetAt(wallAsUtc));
     return wallAsUtc - off1;
@@ -4914,9 +5297,30 @@ async function bulkWrite(rows, opts) {
   return results;
 }
 
+// src/utils/internal-write-response.ts
+function collectInternalWriteResponseFields(schema) {
+  const fields = schema?.fields;
+  if (!fields || typeof fields !== "object") return [];
+  const out = [];
+  for (const [name, def] of Object.entries(fields)) {
+    if (def && def.internal === true) out.push(name);
+  }
+  return out;
+}
+function omitInternalFieldsFromWriteResponse(schema, records) {
+  if (!records) return;
+  const internalFields = collectInternalWriteResponseFields(schema);
+  if (internalFields.length === 0) return;
+  const list = Array.isArray(records) ? records : [records];
+  for (const row of list) {
+    if (!row || typeof row !== "object") continue;
+    for (const field of internalFields) delete row[field];
+  }
+}
+
 // src/utils/migration-journal.ts
 var import_node_crypto3 = require("crypto");
-var import_system3 = require("@objectstack/spec/system");
+var import_system4 = require("@objectstack/spec/system");
 var SYSTEM_CTX = { isSystem: true };
 var DEFAULT_CHUNK_SIZE = 200;
 function engineCanRollBack(engine) {
@@ -4974,14 +5378,14 @@ function hashMigrationPlan(plan, chunks) {
 }
 async function appendEvent(engine, event, execContext) {
   await engine.insert(
-    import_system3.MIGRATION_JOURNAL_OBJECT,
+    import_system4.MIGRATION_JOURNAL_OBJECT,
     { ...event, created_at: event.created_at ?? (/* @__PURE__ */ new Date()).toISOString() },
     { context: execContext ?? { ...SYSTEM_CTX } }
   );
 }
 async function readRunJournal(engine, runId) {
   const rows = await engine.find(
-    import_system3.MIGRATION_JOURNAL_OBJECT,
+    import_system4.MIGRATION_JOURNAL_OBJECT,
     { where: { run_id: runId } },
     { context: { ...SYSTEM_CTX } }
   );
@@ -4996,7 +5400,7 @@ function chunkSetOf(events, kind) {
 }
 async function findInterruptedRuns(engine) {
   const started = await engine.find(
-    import_system3.MIGRATION_JOURNAL_OBJECT,
+    import_system4.MIGRATION_JOURNAL_OBJECT,
     { where: { kind: "run_started" } },
     { context: { ...SYSTEM_CTX } }
   );
@@ -5504,6 +5908,46 @@ function filterTokenContextFrom(execCtx, now) {
   };
 }
 
+// src/utils/temporal-comparand.ts
+var import_data3 = require("@objectstack/spec/data");
+function temporalComparandKind(fieldType) {
+  if (fieldType === "datetime") return "datetime";
+  if (fieldType === "date") return "date";
+  if (fieldType === "time") return "time";
+  return null;
+}
+function readsAsInstant(s) {
+  if (/^-?\d+$/.test(s)) return Number.isFinite(new Date(Number(s)).getTime());
+  const iso = /^\d{4}-\d{2}-\d{2}$/.test(s) ? `${s}T00:00:00.000Z` : /^\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}(:\d{2}(\.\d+)?)?$/.test(s) ? `${s.replace(" ", "T")}Z` : s;
+  return Number.isFinite(Date.parse(iso));
+}
+function readsAsCalendarDay(s) {
+  return /^\d{4}-\d{2}-\d{2}/.test(s);
+}
+function readsAsWallClock(s) {
+  const m = /^(\d{2}):(\d{2})(?::(\d{2})(?:\.(\d+))?)?$/.exec(s);
+  if (!m) return false;
+  return Number(m[1]) <= 23 && Number(m[2]) <= 59 && Number(m[3] ?? "0") <= 59;
+}
+function isUninterpretableTemporalComparand(kind, value) {
+  if (typeof value !== "string") return false;
+  const s = value.trim();
+  if (s === "") return false;
+  if ((0, import_data3.classifyFilterToken)(value) !== null) return false;
+  if (kind === "datetime") return !readsAsInstant(s);
+  if (kind === "date") return !readsAsCalendarDay(s);
+  return !(readsAsWallClock(s) || readsAsInstant(s));
+}
+
+// src/utils/record-not-found.ts
+function recordNotFoundError(object, id) {
+  const err = new Error(`Record ${id} not found in ${object}`);
+  err.code = "RECORD_NOT_FOUND";
+  err.status = 404;
+  err.object = object;
+  return err;
+}
+
 // src/health-monitor.ts
 var PluginHealthMonitor = class {
   constructor(logger) {
@@ -6480,13 +6924,19 @@ var NamespaceResolver = class {
     return `${shortName}_${ns}`;
   }
 };
+
+// src/index.ts
+var import_contracts = require("@objectstack/spec/contracts");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ADMIN_STANDING_SURFACE,
   ANONYMOUS_DENY_BODY,
   ANONYMOUS_DENY_CODE,
   ANONYMOUS_DENY_MESSAGE,
   ANONYMOUS_DENY_STATUS,
   API_KEY_PREFIX,
+  AUDIENCE_BINDING_SUGGESTION_STATUSES,
+  AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES,
   CORE_FALLBACK_FACTORIES,
   DependencyResolver,
   ENTRY_EXECUTION_CONTEXT_FIELDS,
@@ -6515,16 +6965,22 @@ var NamespaceResolver = class {
   SecurePluginContext,
   SemanticVersionManager,
   ServiceLifecycle,
+  UNMATCHED_ROUTE_PATTERN,
   UnknownFilterTokenError,
   UnresolvedFilterTokenError,
+  adminStandingColumns,
+  adminStandingTables,
   assembleExecutionContext,
   assembleExecutionContextOrGuest,
   assertInitServiceRequirements,
+  assertMetadataRegisterContract,
   bucketKeyToCalendarRange,
   buildPermissionsFromGrants,
   bulkWrite,
   calendarPartsInTz,
   calendarPartsInTzOrUtc,
+  canonicalMetadataServiceType,
+  collectInternalWriteResponseFields,
   counterSignPayload,
   createLogger,
   createMemoryCache,
@@ -6538,6 +6994,7 @@ var NamespaceResolver = class {
   defaultIsTransientError,
   derivePosture,
   describeInitOrderFault,
+  effectiveTenancyPosture,
   engineCanRollBack,
   evaluateAuthGate,
   extractApiKey,
@@ -6549,19 +7006,25 @@ var NamespaceResolver = class {
   getMemoryUsage,
   hashApiKey,
   hashMigrationPlan,
+  isAudienceBindingSuggestionStatus,
   isAuthGateAllowlisted,
   isExpired,
   isGrantActive,
   isGrantExpired,
   isNode,
+  isRowActive,
+  isUninterpretableTemporalComparand,
   nextUtcCalendarDay,
   normalizeAuthGate,
+  omitInternalFieldsFromWriteResponse,
   parseScopes,
   parseSignature,
   planChunks,
   postureVisibleRows,
   readAuthoredTranslationLayer,
   readRunJournal,
+  recordNotFoundError,
+  resolveApiKeyAdmission,
   resolveApiKeyPrincipal,
   resolveAuthzContext,
   resolveFilterToken,
@@ -6575,6 +7038,8 @@ var NamespaceResolver = class {
   safeExit,
   shouldDenyAnonymous,
   signPayload,
+  temporalComparandKind,
+  unknownAudienceBindingSuggestionStatusMessage,
   utcInstantMs,
   validateInitServiceContract,
   verifyPayload,
@@ -6584,6 +7049,7 @@ var NamespaceResolver = class {
   wireAuthoredTranslationSync,
   withTransientRetry,
   withoutOperationPrivateKeys,
-  zonedDateStartToUtcMs
+  zonedDateStartToUtcMs,
+  zonedWallClockToUtcMs
 });
 //# sourceMappingURL=index.cjs.map